$ CyberApocalypse2026

HACKTHEBOX CA26 Very-Easy FOR

Force Push

A force-push hid a commit, but ORIG_HEAD and the dangling object survived. Recovered the leaked reliquary credentials.

#CyberApocalypse2026#Forensics#Very-Easy#Recover#Git#force-push
HACKTHEBOX CA26 Very-Easy FOR

The Compressed Truth

Analyzing NTUSER.DAT hives with RegRipper to trace CROWQUILL's stolen-credential access to vmarr's machine, uncovering KeeFarce credential theft and a staged/exfiltrated archive via 7-Zip artifacts.

#CyberApocalypse2026#Forensics#Very-Easy#Registry#RegRipper#KeeFarce#KeePass
HACKTHEBOX CA26 Very-Easy WEB

Massagold

Stored XSS via unescaped EJS output, CSP bypassed using a Google JSONP endpoint, payload delivered to an admin bot that exfiltrated the flag from the admin inbox back to us.

#CyberApocalypse2026#Web#Very-Easy#Stored-XSS#CSP-Bypass
HACKTHEBOX CA26 Very-Easy WEB

Gatery

An Elysia backend's signed session cookie fails to verify signatures (CVE-2025-66457), letting a forged session=inside cookie bypass auth.

#CyberApocalypse2026#Web#Very-Easy#CVE-2025-66457#Elysia
HACKTHEBOX CA26 Easy ICS

Line Tap

Fingerprinted a Telnet service running vulnerable GNU InetUtils telnetd, exploited CVE-2026-24061 via USER env injection to bypass auth and grab root shell + flag.

#CyberApocalypse2026#ICS#Easy#CVE-2026-24061#InetUtils